Ironically, link previews can help avoid Rick rolls but can hurt security because the link needs to be looked at to generate the preview. If it exploits some flaw (rather than being a phishing thing) or just wants to track if the link has been loaded or grab the IP, then you don’t even get to choose to not click it to avoid that.